myorg.local-email.sub.root.ca.conf

# Myorg Email Signing CA

[ default ]
ca                      = myorg.local-email.sub.root.ca # CA name
dir                     = $ENV::PKICTL_CA_DIR       # Top dir
base_url                = http://pki.myorg.local    # CA base URL
aia_url                 = $base_url/$ca.crt         # CA certificate URL
crl_url                 = $base_url/$ca.crl         # CRL distribution point
ocsp_url                = $base_url/ocsp            # OCSP service location
name_opt                = multiline,-esc_msb,utf8   # Display UTF-8 characters

[ req ]
default_bits            = 4096                      # RSA key size
encrypt_key             = yes                       # Protect private key
default_md              = sha256                    # MD to use
utf8                    = yes                       # Input is UTF-8
string_mask             = utf8only                  # Emit UTF-8 strings
prompt                  = no                        # Don't prompt for DN
distinguished_name      = ca_dn                     # DN section
req_extensions          = ca_reqext                 # Desired extensions

[ ca_dn ]
countryName             = "US"
organizationName        = "Myorg"
organizationalUnitName  = "Myorg Certificate Authority"
commonName              = "Myorg Email Signing CA"

[ ca_reqext ]
keyUsage                = critical,keyCertSign,cRLSign
basicConstraints        = critical,CA:true,pathlen:0
subjectKeyIdentifier    = hash

# CA operational settings

[ ca ]
default_ca              = email_ca                  # The default CA section

[ email_ca ]
certificate             = $dir/$ca/$ca.crt          # The CA cert
private_key             = $dir/$ca/private/$ca.key  # CA private key
new_certs_dir           = $dir/$ca/certs            # Certificate archive
serial                  = $dir/$ca/db/$ca.crt.srl   # Serial number file
crlnumber               = $dir/$ca/db/$ca.crl.srl   # CRL number file
database                = $dir/$ca/db/$ca.db        # Index file
unique_subject          = no                        # Require unique subject
default_days            = 730                       # How long to certify for
default_md              = sha256                    # MD to use
policy                  = policy_match              # Default naming policy
email_in_dn             = no                        # Add email to cert DN
preserve                = no                        # Keep passed DN ordering
name_opt                = $name_opt                 # Subject DN display options
cert_opt                = ca_default                # Certificate display options
copy_extensions         = copy                      # Copy extensions from CSR
x509_extensions         = email_ext                 # Default cert extensions
default_crl_days        = 1                         # How long before next CRL
crl_extensions          = crl_ext                   # CRL extensions

[ policy_match ]
countryName             = match
stateOrProvinceName     = optional
localityName            = optional
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied

[ policy_anything ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
emailAddress            = optional
domainComponent         = optional

# Extensions

[ email_ext ]
keyUsage                = critical,digitalSignature,keyEncipherment
basicConstraints        = CA:false
extendedKeyUsage        = emailProtection,clientAuth,anyExtendedKeyUsage
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always
authorityInfoAccess     = @issuer_info
crlDistributionPoints   = @crl_info

[ crl_ext ]
authorityKeyIdentifier  = keyid:always
authorityInfoAccess     = @issuer_info

[ issuer_info ]
caIssuers;URI.0         = $aia_url
OCSP;URI.0              = $ocsp_url

[ crl_info ]
URI.0                   = $crl_url